$req can legitimately be null, so we need to add
null to the assert as well, so the code doesn't
stop immediately.
This is a follow-up for I83f9374b2f3236097860f4aecc694326b891905b
Change-Id: I85dbc1b4c1452d0671879e6cc02c5411090b1d1d
Also use it to only log the title blacklist hit when running for real,
not when testing a username.
Change-Id: Ie9639a15d04b387be0e72754301eb6d91cd8adc2
